Threat-actors have exploited a critical SQL injection vulnerability within multiple versions of BQE’s BillQuick Web Suite to deploy ransomware against victim networks. The vulnerability, tracked as CVE-2021-42258, is easily exploited by using login requests with invalid characters (a single quote) in the username field, which can be leveraged to gain initial access, and perform remote code execution (RCE) for the purpose of mounting ransomware. Researchers at Huntress Labs were able to recreate this SQL injection-based attack, and a US engineering company has already fallen victim to a ransomware attack after threat-actors attacked a vulnerable BillQuick server. The specific ransomware group behind these attacks has yet to be identified, and according to researchers, based on the tactics techniques and procedures (TTP) employed, this group has been active since May 2020. This vulnerability has since been patched, and users are urged to upgrade to the latest stable version immediately. The Ankura CTAPT will continue to follow this ransomware group, and an update on their identity will be released as that information becomes known.